Modules Installation and Updating - SharePoint Page 0 of 23

Transcription

1 Modules Installation and Updating - SharePoint Page 0 of 23 Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

2 1 Contents 1 Preface Prerequisites Supported Servers Installation of QualiWare Document Connector Configuration of List of SharePoint Servers On-Premises SharePoint Online Permissions Configuration of Single Sign-On Prerequisites Log on as for Windows Service Update Configuration Files Internet Information Services (IIS) Configuration IIS Application Pool Enable Windows Authentication Add domain Service Account to IIS_IUSRS Group Create SPNs Server and Domain Service Account Trust for Delegation Enable Server to be Trusted for Delegation Enable Domain Service Account to be Trusted for Delegation SharePoint Server On-Premises SharePoint Online Legend References Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

3 1 Preface This document describes installation and configuration of QualiWare Document Connector (hereinafter QDC). 2 Prerequisites The document assumes that QualiWare Exceution Framework (hereinafter QEF) is installed. As a client Web Forms and/or QualiWare Lifecycle Manager (hereinafter QLM) may be installed, but not required. License in QEF is required for QDC to work with SharePoint server. Some of the configuration steps may require domain administrator permissions. 3 Supported Servers Supported server operating systems: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2. Supported SharePoint Servers: SharePoint Server 2010, SharePoint Server Installation of QualiWare Document Connector // TODO 4.1 Configuration of List of SharePoint Servers On-Premises Before QDC can connect to any SharePoint server, a list of SharePoint servers must be defined. To define list of SharePoint servers follow these steps: 1. Open Admin Console -> Modules. 2. Select QualiWare SharePoint Connector. 3. Click Settings. 4. On Module tab click Advanced button. 5. Click Add. 6. Set name Settings, select type String. 7. Insert this string in JSON format and change Urls and names to yours: {"Servers": [{"Name":"Friendly name for server 1", "Url":"your server 1 address here", "Type":"Qdc.QualiWare.Connectors.SharePoint"}, {"Name":"Friendly name for server 2", "Url":"your server 2 address here", "Type":"Qdc.QualiWare.Connectors.SharePoint"}],"ContentProvider":"Qdc.Providers.QualiWare"} Example: Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

4 {"Servers":[{"Name":"Default SharePoint Server","Url":" Documents"}],"ContentProvider":"Qdc.Providers.QualiWare","DefaultServerName":"Default SharePoint Server"} List can contain any number of servers. Add them in a similar way. Make sure addresses that are set above are the same as in module license(s). 8. Click Add. 9. Click OK SharePoint Online 1. Type. To point to SharepointOnline the following type should be specified in module s settings: Qdc.QualiWare.Connectors.SharePointOnline 2. CLAIMS Authentication. Basic authentication mechanism for SharePoint Online is CLAIMS and, by default, domain users cannot be authenticated without preceding complex setup of both AD DS/AD FS and SharePoint Online. CLAIMS authentication requires 2 options (3 in case of SSO) Home Realm Discovery (HRD) service URL (AuthHrdUrl parameter in module s settings, used in SSO scenario only, check below) Secure Token Service (STS) service URL (AuthStsUrl parameter in module s settings) Realm login service (AuthRelativeRealmPath parameter in module s settings) 2.1. AuthHrdUrl. By default points to: AuthStsUrl. By default is set up for E-subscription and points to: For P-subscription should be: RelativeRealmPath. Should be relative as it is added to the actual server URL from settings. Defaults to: _forms/default.aspx?wa=wsignin1.0 HRD provides a URL where Kerberos token is exchanged with SAML assertion (SSO only), STS provides a secure token which is required by Login page. The latter takes a secure token provided by STS, user login and password and replies with authorization cookies. For more details refer to Online.aspx. 3. TaxonomyService and ChangeTokenProvider webservices which could be installed on SharePoint On-Premises server. SharePoint Online does not allow installing any compiled code on it. So similar API exposed by these webservices are available through CSOM (Client SharePoint Object Model) TaxonomyOverCsom. This setting of module s settings controls whether to use CSOM or the good old webservices installed on the SharePoint server. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

5 Please note that CSOM is available only starting from SharePoint 2013, both On-Premises and Online. Defaults to false. For SharePoint Online is automatically set to true TaxonomyLanguageCode. This setting of module s settings controls what language code ID to use when working with taxonomy data. Defaults to module s process culture. Below is the obvious example of QDC module settings for SharePoint Online: {"Servers":[{"Name":"Default SharePoint Server", "Url":" "Type":"Qdc.QualiWare.Connectors.SharePointOnline", "Path":"Shared Documents", TaxonomyOverCsom :true, TaxonomyLanguageCode : 1033 }],"ContentProvider":"Qdc.Providers.QualiWare","DefaultServerNa me":"default SharePoint Server"} Here value 1033 corresponds to en-us language. 5 Permissions In order for user to browse SharePoint libraries using QualiWare SharePoint Connector module (Document Browser), user must have read permission. Read Permission Level by default does not include Browse Directories permission. To grant minimal read permission: 1. Open SharePoint site. 2. Go to Site Actions -> Site Permissions -> Permission Levels. 3. Click on Read permission level. 4. Click Copy Permission Level. 5. Give name to new permission level. 6. Check Browse Directories under Site Permissions. 7. Click Submit. 8. Assign created permission level to user or group, which needs read access to SharePoint site. 6 Configuration of Single Sign-On QDC supports Single Sign-On when no password is required to connect to SharePoint server. 6.1 Prerequisites By default QEF Windows service is run using LocalSystem account and all Application Pools in IIS are run under ApplicationPoolIdentity. Despite the fact that this is a correct configuration, it is advised to use domain service account to run QEF Windows service and Application Pool. 6.2 Log on as for Windows Service It is advised to specify domain service account used to run QEF Windows service during QEF installation. Otherwise the setting will be restored back to its original value, when QEF is re-installed, upgraded or reconfigured. To set domain service account as account to run QEF Windows service: Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

6 1. Open Windows Services. 2. Right-click QEF Windows service and select Properties. 3. Open Log On tab. 4. Select This account. 5. Enter domain service account credentials. 6. Click OK. 7. Restart QEF Windows service. 6.3 Update Configuration Files 1..NET Remoting must be setup to use secure channel. Modify: - Program Files\QualiWare\QEF\Bin\Qef.exe.config - Configuration files of all installed modules and QLM Section: <configuration> <system.runtime.remoting> <application name="qef"> <channels> <channel secure= true >. 2. Impersonation level must be set to impersonate. Modify: - Program Files\QualiWare\QualiWare Execution Framework\Bin\Qef.exe.config - Program Files\QualiWare\QualiWare Execution Framework\Modules\QualiWare Integration Server\6.0\Qis.exe.config Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

7 - Program Files\QualiWare\QEF\Web\Console\Web.config - Program Files\QualiWare\QEF\Web\WebModules\QIS WebForms\6.0\Web.config Section: <configuration> <system.runtime.remoting> <application name="qef"> <channels> <channel secure= true tokenimpersonationlevel="impersonation"> 3. Impersonation must be enabled. Modify: - Program Files\QualiWare\QEF\Modules\QualiWare SharePoint Connector\6.0\Bin\Qdc.Module.exe.config Section: <configuration> <system.runtime.remoting> <application name="qef"> <channels> <channel secure= true impersonate="true"> 4. Impersonation level must be set to delegation and serviceprincipalname must be set to server or domain service account. Modify: - Program Files (x86)\qualiware\qlm\models\qwcd32.exe.config a. SPN of server where QEF Windows service is running, if it is running under LocalSystem account. Section: <configuration> <system.runtime.remoting> <application name="qef"> <channels> <channel secure="true" tokenimpersonationlevel="delegation" serviceprincipalname="http/<server_name>"> b. Domain service account, if QEF Windows service is running under domain service account. Section: <configuration> Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

8 <system.runtime.remoting> <application name="qef"> <channels> <channel secure="true" tokenimpersonationlevel="delegation" 6.4 Internet Information Services (IIS) Configuration IIS Application Pool 1. Open Internet Information Services (IIS) Manager. 2. Select Application Pools. 3. Click Add Application Pool action. 4. In Name enter QualiWare. 5. In.NET Framework version seletc the.net Framework v In Managed pipeline mode select Integrated. 7. Click OK. 8. Click on the application pool and click Advanced Settings action. 9. Select Identity setting and click Browse button. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

9 10. Select Custom Account and click Set button. 11. Enter domain service account credentials and click OK. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

10 12. Select Default Web Site. 13. Click Basic Settings action. 14. Click on the Select... button. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

11 15. Select the application pool named QualiWare and click OK. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

12 16. Ensure that the Application Pool is used by all virtual directories. By default it should be automatically inherited Enable Windows Authentication. 1. Open Internet Information Services (IIS) Manager. 2. Select Default Web Site. 3. Double-click Authentication. 4. Right-click on Windows Authentication and select Enable. 5. Select Windows Authentication and click Providers action. 6. Ensure Negotiate is in the list of Enabled Providers and select it. 7. Click Move Up button to move Negotiate to the top and click OK. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

13 8. Click Advanced Settings action. 9. Ensure Enable Kernel-mode authentication is unchecked and click OK. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

14 10. Select Default Web Site. 11. Double-click Configuration Editor. 12. Select in Section: system.webserver/security/authentication/windowsauthentication 13. Select in From: ApplicationHost.config 14. Set useapppoolcredentials to True. 15. Set usekernelmode to False. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

15 16. Click Apply action. 17. Ensure that the Windows Authentication settings are used by all virtual directories. By default they should be automatically inherited Add domain Service Account to IIS_IUSRS Group 1. Open Computer Management MMC and navigate to Local Users and Groups -> Groups 2. Double-click on the IIS_IUSRS local group. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

16 3. Add domain service account to the group and click OK. 6.5 Create SPNs Service Principal Name (SPN) must be created, if QEF Windows service is running under domain service account Server and Domain Service Account Create SPN for domain service account under which QEF Windows service and IIS Application Pool are running. SPN is registered with setspn command (this command is performed on computer in the same domain as the target computer by domain administrator): setspn A http/<qef_server_name> <domain_name>\<qef_account> <qef_server_name> domain name of the machine, where QEF is running <qef_account> domain account, under which QEF is running Important: SPN must be registered for NetBIOS and UPN names of server. The same is applied to SharePoint server (see below). For viewing existing SPNs, use one of the following commands: setspn L <domain_name>\<qef_account> setspn Q http/<qef_server_name> Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

17 To register SPNs, use the following commands: setspn S http/rctest <domain_name>\<qef_account> setspn S http/rctest.qualiware.local <domain_name>\<qef_account> Note: For Windows Server 2003 use: setspn L <domain_name>\<qef_account> setspn A http/rctest <domain_name>\<qef_account> setspn A http/rctest.qualiware.local <domain_name>\<qef_account> 6.6 Trust for Delegation Server and domain service account must be enabled to be trusted for delegation Enable Server to be Trusted for Delegation Setup server on which QEF is installed to be trusted for delegation. This action is performed on domain controller computer by domain administrator. For this: 4. Open Active Directory Users and Computers management console. 5. Select domain and under Computers node find computer where QEF is installed. 6. Right-click the computer and select Properties. 7. On Delegation tab select Trust this computer for delegation to any service (Kerberos only). 8. Click OK. It is often that only domain administrator has access to domain controller. This makes it time-consuming to check that server is enabled to be trusted for delegation. Alternatively to check if server is enabled to be trusted for delegation, ADExplorer (from Sysinternals) can be used. To do so, connect to domain controller with ADExplorer and find server. Inspect the value of useraccountcontrol property. If the value is less than , it is an indication of that server is not enabled to be trusted for delegation. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

18 For list of possible flags for useraccountcontrol property, refer to Enable Domain Service Account to be Trusted for Delegation Setup domain service account under which QEF Windows service and IIS Application Pool are running to be trusted for delegation. This action is performed on domain controller computer by domain administrator. For this: 1. Open Active Directory Users and Computers management console. 2. Select domain and under Users node find domain service account. 3. Right-click the user and select Properties. 4. On Delegation tab select Trust this user for delegation to any service (Kerberos only). 5. Click OK. It is often that only domain administrator has access to domain controller. This makes it time-consuming to check that domain service account is enabled to be trusted for delegation. Alternatively to check if domain service account is enabled to be trusted for delegation, ADExplorer (from Sysinternals) can be used. To do so, connect to domain controller with ADExplorer and find domain service account. Inspect the value of useraccountcontrol property. If the value is less than , it is an indication of that server is not enabled to be trusted for delegation. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

19 For list of possible flags for useraccountcontrol property, refer to SharePoint Server On-Premises SPN When SharePoint server is installed, SPN is set for the server automatically. Make sure that SPN for SharePoint server is registered for NetBIOS and UPN names of server. For viewing existing SPNs, use one of the following commands: setspn L <domain_name>\<qef_account> setspn Q http/<sharepoint_server_name> To register SPNs, use the following commands: setspn S http/sharepoint2010 <domain_name>\<sharepoint_account> setspn S http/sharepoint2010.qualiware.local <domain_name>\<sharepoint_account> Note: For Windows Server 2003 use: setspn L <domain_name>\<sharepoint_account> setspn A http/sharepoint2010 <domain_name>\<sharepoint_account> Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

20 setspn A http/sharepoint2010.qualiware.local <domain_name>\<sharepoint_account> Example of correct SPNs for server, domain service account and SharePoint: Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

21 Enable Integrated Windows Authentication (Kerberos) By default, SharePoint uses NTLM provider for Windows authentication. To make SharePoint use Kerberos provider for Windows authentication: 1. Go to server where SharePoint is installed. 2. From Start menu open SharePoint Central Administration. 3. Go to Security -> General Security -> Specify authentication providers. 4. Click Default zone. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

22 5. Under Claim Authentication Types make sure that Enable Windows Authentication and Integrated Windows authentication are enabled and Negotiate (Kerberos) is selected. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

23 6. Click OK SharePoint Online The difference comparing to SharePoint On-Premises server is substantial and requires complex setup of both AD DS/AD FS and SharePoint Online servers. Please refer to this article on how to set it up: Legend Screenshots are taken from the environment with the following data: Domain: cfc.local (DPA-DOM-1) Server name: kf-qlm QEF service account: QualiWare application pool account: Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23

24 6.9 References - Describes how to configure Kerberos for IIS. - Check list for Kerberos. - Describes how to check if computer or user is enabled to be trusted for delegation. - Describes values of useraccountcontrol property for computer and user in Active Directory. - Test page outputting information about authentication method used by current request. Document Name: One Time Configurations Inside QEF - Modules Installation and 11 July / 23